socket-security[bot]
commented
1 year ago New dependency changes detected. Learn more about Socket for GitHub ↗︎
👍 No new dependency issues detected in pull request
Bot Commands
To ignore an alert, reply with a comment starting with @SocketSecurity ignore followed by a space separated list of package-name@version specifiers. e.g. @SocketSecurity ignore foo@1.0.0 bar@* or ignore all packages with @SocketSecurity ignore-all
Pull request alert summary
| Issue | Status |
|---|---|
| Install scripts | ✅ 0 issues |
| Native code | ✅ 0 issues |
| Bin script shell injection | ✅ 0 issues |
| Unresolved require | ✅ 0 issues |
| Invalid package.json | ✅ 0 issues |
| HTTP dependency | ✅ 0 issues |
| Git dependency | ✅ 0 issues |
| Potential typo squat | ✅ 0 issues |
| Known Malware | ✅ 0 issues |
| Telemetry | ✅ 0 issues |
| Protestware/Troll package | ✅ 0 issues |
📊 Modified Dependency Overview:
🚮 Removed packages: @nuxtjs/eslint-config-typescript@12.0.0, eslint-plugin-prettier@4.2.1, vite@4.2.0
codecov-commenter
This PR contains the following updates:
8.5.1->8.6.0Release Notes
pnpm/pnpm
### [`v8.6.0`](https://togithub.com/pnpm/pnpm/releases/tag/v8.6.0) [Compare Source](https://togithub.com/pnpm/pnpm/compare/v8.5.1...v8.6.0) #### Minor Changes - Some settings influence the structure of the lockfile, so we cannot reuse the lockfile if those settings change. As a result, we need to store such settings in the lockfile. This way we will know with which settings the lockfile has been created. A new field will now be present in the lockfile: `settings`. It will store the values of two settings: `autoInstallPeers` and `excludeLinksFromLockfile`. If someone tries to perform a `frozen-lockfile` installation and their active settings don't match the ones in the lockfile, then an error message will be thrown. The lockfile format version is bumped from v6.0 to v6.1. Related PR: [#6557](https://togithub.com/pnpm/pnpm/pull/6557) Related issue: [#6312](https://togithub.com/pnpm/pnpm/issues/6312) - A new setting, `exclude-links-from-lockfile`, is now supported. When enabled, specifiers of local linked dependencies won't be duplicated in the lockfile. This setting was primarily added for use by [Bit CLI](https://togithub.com/teambit/bit), which links core aspects to `node_modules` from external directories. As such, the locations may vary across different machines, resulting in the generation of lockfiles with differing locations. #### Patch Changes - Don't print "Lockfile is up-to-date" message before finishing all the lockfile checks [#6544](https://togithub.com/pnpm/pnpm/issues/6544). - When updating dependencies, preserve the range prefix in aliased dependencies. So `npm:foo@1.0.0` becomes `npm:foo@1.1.0`. - Print a meaningful error when a project referenced by the `workspace:` protocol is not found in the workspace [#4477](https://togithub.com/pnpm/pnpm/issues/4477). - `pnpm rebuild` should not fail when `node-linker` is set to `hoisted` and there are skipped optional dependencies [#6553](https://togithub.com/pnpm/pnpm/pull/6553). - Peers resolution should not fail when a linked in dependency resolves a peer dependency. - Build projects in a workspace in correct order [#6568](https://togithub.com/pnpm/pnpm/pull/6568). #### Our Gold SponsorsConfiguration
📅 Schedule: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).
🚦 Automerge: Enabled.
♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
This PR has been generated by Mend Renovate. View repository job log here.